PHPSESSID keeps poping up in address bar??

[halfasleeps]

on my website i keep noticing that at random times something like PHPSESSID=72b480fac7a024a490e9ee0d48eeae6f will be passed in the address bar as a GET var. I don't understand why...i did not program that....is someone hijacking my site or is that something else?

Thanks.

[World Wide Weird]

PHP automatically rewrites URLs to include the session ID if the user's browser doesn't accept cookies, or if PHP hasn't yet determined that the browser accepts cookies.

[halfasleeps]

great thinks.....now I can stop panicing lol

[Raffles]

I think it also happens if you do session_start() after outputting stuff to the browser.

[dbr]

You can edit your php.ini file to disable passing the sessionID in the URL.
Search your php.ini file to find:
session.use_trans_sid = 1

Change that to:
session.use_trans_sid = 0

And, you should be good to go if you don't want the sessionID passed in the URL

; trans sid support is disabled by default.
; Use of trans sid may risk your users security.
; Use this option with caution.
; - User may send URL contains active session ID
; to other person via. email/irc/etc.
; - URL that contains active session ID may be stored
; in publically accessible computer.
; - User may access your site with the same session ID
; always using URL stored in browser's history or bookmarks.
session.use_trans_sid = 0

[halfasleeps]

You can edit your php.ini file to disable passing the sessionID in the URL.
Search your php.ini file to find:
session.use_trans_sid = 1

Change that to:
session.use_trans_sid = 0

And, you should be good to go if you don't want the sessionID passed in the URL

Thanks for the info, in this case I don't think I have the ability to edit the php.ini since I am using a hosting company. I don't mind the sessid being displayed tho, I just didn't know why it was there and wanted to make sure something bad wasn't going on. lol

[dbr]

Depends... If you have access to a cgibin you can place your own php.ini there that should trump their default.
Sometimes just putting a php.ini in your sites main directory will trump the default. In my case I had to place it in the cgibin.
There are pros and cons with having the session ID attached to the URL. But, overall you are probably fine. The main reason for it are for users who don't like cookies and turn them off in their browser to still use sessions.

Good luck!

[Kailash Badu]

If you do not have permission to edit php.ini, you can edit these variables from .htaccess (in most of the cases i.e. unless you host explicitly disables it).

[wheeler]

Depends... If you have access to a cgibin you can place your own php.ini there that should trump their default.
Sometimes just putting a php.ini in your sites main directory will trump the default. In my case I had to place it in the cgibin.
There are pros and cons with having the session ID attached to the URL. But, overall you are probably fine. The main reason for it are for users who don't like cookies and turn them off in their browser to still use sessions.

Good luck!

This is interesting, I couldn't get a straight answer from my hosting company about where to place a php.ini file, they said to place a php.ini in the site root, and it didn't work. I did get the htaccess method working fine, but i'm going to have to try this cgi-bin method!

how many variations could there possibly be on whm/cpanel anyway?

[voodoomagic]

who is your host? you might try looking in any support knowledge bases they have. for my host, i found out how to set my own php.ini file in the support kb, for how to set the file upload size to whatever you want.

[wheeler]

currently with Australian company called hosting shop - there knowledgebase is far from comprehensive, it doesn't have anything about php.ini. Pretty hard to find great support and great speed these days.

good thing cpanel/whm is so easy to use!

[felgall]

All changing that value does is to stop people from using sessions if they have disabled cookies. Usually the query string is only used to pass session details when cookies are disabled.